Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
255,781 total · sorted newest first- Jul 9, 2026
Malicious code in myclaude-code (npm)
- Jul 9, 2026
Malicious code in clavuepro (npm)
1 compromised version
- Jul 9, 2026
Malicious code in clavue-agent-sdk (npm)
1 compromised version
- Jul 9, 2026
Malicious code in clavue (npm)
- Jul 9, 2026
Malicious code in calvuepro (npm)
1 compromised version
- Jul 9, 2026
Malicious code in @calm2026/imux (npm)
- Jul 9, 2026
Malicious code in tailwind-core (npm)
4 compromised versions
- Jul 9, 2026
Malicious code in testudo-pack (npm)
1 compromised version
- Jul 9, 2026
Malicious code in testis-pack (npm)
1 compromised version
- Jul 9, 2026
Malicious code in antsrcsrctest (npm)
1 compromised version
- Jul 9, 2026
Malicious code in nodemon-sudo (npm)
1 compromised version
- Jul 8, 2026
Malicious code in tronsev (PyPI)
1 compromised version
- Jul 8, 2026
Malicious code in none123s (npm)
17 compromised versions
- Jul 8, 2026
Malicious code in dbzy-tools (PyPI)
1 compromised version
- Jul 8, 2026
Malicious code in tslint-conf (npm)
1 compromised version
- Jul 8, 2026
Malicious code in @vite-js/ui (npm)
2 compromised versions
- Jul 8, 2026
Malicious code in logger-daemon-regex (npm)
1 compromised version
- Jul 8, 2026
Malicious code in n8n-nodes-barcode-generator (npm)
1 compromised version
- Jul 8, 2026
Malicious code in react-v17 (npm)
1 compromised version
- Jul 8, 2026
Malicious code in npm-rce-poc (npm)
1 compromised version
- Jul 8, 2026
Malicious code in @vraksha/gh-helper (npm)
1 compromised version
- Jul 8, 2026
Malicious code in crypto-promiser (npm)
2 compromised versions
- Jul 8, 2026
Malicious code in vps-new-manager (npm)
2 compromised versions
- Jul 8, 2026
Malicious code in events-alias (npm)
1 compromised version
- Jul 8, 2026
Malicious code in chai-as-const (npm)
1 compromised version
- Jul 8, 2026
Malicious code in configration (npm)
1 compromised version
- Jul 8, 2026
Malicious code in next-locomotive-init (npm)
5 compromised versions
- Jul 8, 2026
Malicious code in @vite-tab/tab (npm)
2 compromised versions
- Jul 8, 2026
Malicious code in turbom (PyPI)
2 compromised versions
- Jul 8, 2026
Malicious code in luludawang-kit (npm)
1 compromised version
- Jul 8, 2026
Malicious code in ec-checker (npm)
1 compromised version
- Jul 8, 2026
Malicious code in chai-redirection (npm)
3 compromised versions
- Jul 8, 2026
Malicious code in chai-presentation (npm)
4 compromised versions
- Jul 8, 2026
Malicious code in airkey-mfa-react (npm)
4 compromised versions
- Jul 8, 2026
Malicious code in pipo-sdk (npm)
1 compromised version
- Jul 8, 2026
Malicious code in goofy-sdk (npm)
1 compromised version
- Jul 8, 2026
Malicious code in @luminarycloudinternal/lcvis-st (npm)
3 compromised versions
- Jul 8, 2026
Malicious code in bytefaas-sdk (npm)
1 compromised version
- Jul 8, 2026
Malicious code in searchresults (npm)
1 compromised version
- Jul 8, 2026
Malicious code in thunder-rony (npm)
1 compromised version
- Jul 8, 2026
Malicious code in ronyfortest (npm)
1 compromised version
- Jul 8, 2026
Malicious code in rony-test (npm)
1 compromised version
- Jul 8, 2026
Malicious code in higherlogic-ocfe (npm)
1 compromised version
- Jul 8, 2026
Malicious code in babel-eslint-parser-legacy (npm)
1 compromised version
- Jul 8, 2026
Malicious code in ag-charts-test (npm)
1 compromised version
- Jul 8, 2026
Malicious code in visa-cli-tools (npm)
1 compromised version
- Jul 8, 2026
Malicious code in ai-gen-ai-opt-in (npm)
1 compromised version
- Jul 8, 2026
Malicious code in @luminarycloudinternal/frodo (npm)
3 compromised versions
- Jul 8, 2026
Malicious code in promo-helper (npm)
8 compromised versions
- Jul 8, 2026
Malicious code in manom (PyPI)
1 compromised version
Page 12 of 5,116